Repository advisory GHSA-c7vj-4cqh-8cv9 not available in the GitHub Advisory Database

Open

#9,435 opened on Sep 9, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 38/100

Issue type: Feature
Clarity: Mostly clear
Activity status: Active
Tech stack: go
Domain: security

Research direction

Review the linked repository advisory for GHSA-c7vj-4cqh-8cv9 and the global advisory URL, then determine the GitHub Advisory Database eligibility and ingestion path. Done means the advisory is available globally or the issue receives a clear explanation of why it is not eligible.

Written by the indexing model from the issue text.

Description

Summary

The published repository security advisory GHSA-c7vj-4cqh-8cv9 for wollomatic/socket-proxy is not currently available through the global
GitHub Advisory Database.

The advisory is published in the source repository:

Repository advisory:
https://github.com/wollomatic/socket-proxy/security/advisories/GHSA-c7vj-4cqh-8cv9

However, the corresponding global advisory URL returns HTTP 404:

Global advisory:
https://github.com/advisories/GHSA-c7vj-4cqh-8cv9

Advisory details

GHSA: GHSA-c7vj-4cqh-8cv9
Repository: wollomatic/socket-proxy
Package: github.com/wollomatic/socket-proxy
Ecosystem: Go
Severity: Critical
CVSS: 9.6
Affected versions: >= 1.8.0, <= 1.12.3
Patched version: 1.13.0
Published: 2026-08-13
CVE: No known CVE

The repository advisory describes a restriction bypass in the -allowbindmountfrom / SP_ALLOWBINDMOUNTFROM control. Under affected
configurations, a client may be able to create Docker containers, Swarm services, or volumes with host bind mounts outside the configured
allowlist.

Request

Could you please review the advisory and either:

ingest it into the global GitHub Advisory Database, or
provide information about why it is not eligible for ingestion?

A CVE was already requested through GitHub's "Request CVE" workflow some time ago. However, no CVE has been assigned so far, and the advisory
is still not available through the global GitHub Advisory Database (see also https://github.com/wollomatic/socket-proxy/issues/176).

Thank you.

Dominant language: No language data
Stars: 2.5k
Forks: 772
Avg merge: 3d 18h
Merged PRs (30d): 48

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

databricks/databricks-sql-nodejs#526 · Opened Sep 22, 2026
pii_scan gate does not block on its two critical rules: an SSN or credit-card number passes Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

sipyourdrink-ltd/bernstein#6191 · Opened Sep 22, 2026
injector: non-canonical loopback spellings bypass echo detection Open

security severity:low track:open-source

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

ntindle/spark-vm#259 · Opened Sep 22, 2026
[addtool] DeepZero Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

gwen001/offsectools_www#2055 · Opened Sep 22, 2026
claude auto-review custom_prompt executes shell substitutions Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

WalletConnect/actions#112 · Opened Sep 22, 2026

More Security issues